Terraform Aws Securityhub Module

Terraform module to create an AWS Security Hub

Example

module "securityhub" {
  source  = "blackbird-cloud/securityhub/aws"
  version = "~> 2.0"

  region = "eu-central-1"
}

Requirements

Name	Version
terraform	>= 1
aws	~> 6.0

Providers

Name	Version
aws	~> 6.0

Resources

Name	Type
aws_securityhub_action_target.default	resource
aws_securityhub_configuration_policy.default	resource
aws_securityhub_configuration_policy_association.default	resource
aws_securityhub_finding_aggregator.default	resource
aws_securityhub_organization_configuration.default	resource
aws_securityhub_product_subscription.default	resource
aws_securityhub_standards_control.disabled_rules	resource
aws_securityhub_standards_subscription.best_practices_aws_foundations_benchmark	resource
aws_securityhub_standards_subscription.cis_1_2_aws_foundations_benchmark	resource
aws_securityhub_standards_subscription.cis_1_4_aws_foundations_benchmark	resource
aws_securityhub_standards_subscription.cis_3_0_aws_foundations_benchmark	resource

Inputs

Name	Description	Type	Default	Required
action_targets	Map of action targets to configure, configures AWS Security Hub to send selected insights and findings to Amazon EventBridge.	map(object({ name = string identifier = string description = string }))	{}	no
auto_enable	(Optional) Whether to automatically enable Security Hub for new accounts in the organization. Defaults to false.	bool	true	no
auto_enable_standards	(Optional) Whether to automatically enable Security Hub default standards for new member accounts in the organization. By default, this parameter is equal to DEFAULT, and new member accounts are automatically enabled with default Security Hub standards. To opt out of enabling default standards for new member accounts, set this parameter equal to NONE.	string	"DEFAULT"	no
central_config	Central Security Hub configuration for the organization.	object({ enabled = bool policies = map(object({ ous = optional(map(string)) disabled_controls = optional(list(string)) enabled_controls = optional(list(string)) })) })	{ "enabled": false, "policies": {} }	no
disabled_rules	Map of rules to disable from the enabled standards.	map(object({ standards_control_arn = string disabled_reason = string }))	{}	no
enable_best_practices	Whether to enable the AWS Foundational Security Best Practices standards subscription.	bool	true	no
enable_cis_1_2	Whether to enable the CIS AWS Foundations Benchmark v1.2.0 standards subscription. If you want to disable this, on first deploy leave it enabled, then disable it.	bool	true	no
enable_cis_1_4	Whether to enable the CIS AWS Foundations Benchmark v1.4.0 standards subscription.	bool	false	no
enable_cis_3_0	Whether to enable the CIS AWS Foundations Benchmark v3.0.0 standards subscription.	bool	false	no
linked_regions	List of regions to enable Security Hub in.	object({ type = string regions = optional(list(string)) })	{ "regions": [], "type": "ALL_REGIONS" }	no
product_arns	(Optional) Map of production name : product arn. The ARN of the product that generates findings that you want to import into Security Hub.	map(string)	{}	no
region	AWS Region used for picking up the ARNs for the securityhub standards subscriptions.	string	n/a	yes

Outputs

Name	Description
action_targets	Map of action targets, AWS Security Hub to send selected insights and findings to Amazon EventBridge.
aws_securityhub_configuration_policy	AWS Security Hub Configuration Policy
aws_securityhubaws_securityhub_organization_configuration_config	AWS Security Hub Organization Configuration
disabled_rules	Map of rules to disable from the enabled standards.
product_subscriptions	Map of product subscriptions, the ARN of the product that generates findings that you want to import into Security Hub.

About

We are Blackbird Cloud, Amsterdam based cloud consultancy, and cloud management service provider. We help companies build secure, cost efficient, and scale-able solutions.

Checkout our other 👉 terraform modules

Copyright

Copyright © 2017-2026 Blackbird Cloud